Cozanet Security

Security — Cozanet Security Model

This page describes the actual security model, not marketing claims. No system is fully secure, unhackable, or risk-free, and we do not claim otherwise.

Current model (Phase One)

Authentication: Firebase Authentication (email/password and Google sign-in) issues short-lived tokens; API routes require them.
Wallets: custodial — keys are derived deterministically from a protected master seed and managed server-side. Users operate wallets through their AEGIS account. A non-custodial option is planned, not live.
On-chain operations: transactions are constructed and signed server-side and broadcast to BNB Smart Chain.
Audit trails: platform events are written to append-only audit logging.
Known limitations: custodial key management concentrates risk on Cozanet infrastructure; smart-contract risk on third-party DEX routers applies to swaps; the multi-rail Smart Router is not yet live.

Responsible disclosure

Report suspected vulnerabilities to security@cozanet.net. Please allow reasonable time for a fix before public disclosure.

Roadmap and changelog record real development status.